New Guardrail Reduces MLLM Over-Refusal While Maintaining Safety

Existing safety measures for multimodal large language models (MLLMs) often struggle with a fundamental trade-off: ensuring safety frequently comes at the cost of utility. While fine-tuning models can achieve robust safety, it often compromises the model's general usefulness. Input-side safety guardrails, a lighter alternative, tend to suffer from excessive over-refusal, blocking harmless queries or those the model could have handled safely with a refusal or advisory response. The core problem identified is that input-aware guardrails make safety decisions without considering the MLLM's inherent ability to generate safe outputs. MLLMs often possess internal mechanisms to transform potentially harmful inputs into benign responses, but input-side guardrails override this capability, degrading the user experience. To address this, a new "output-aware" safety guardrail paradigm is proposed. This method operates by analyzing the model's hidden state space to predict if a forthcoming generation will be unsafe before it is fully produced. By training a lightweight classifier using multi-instance contrastive learning on hidden state representations, the approach can distinguish between inputs that will lead to unsafe outputs and those that won't, even if the inputs themselves contain risky elements. This allows for precise intervention only when the model's actual response would be harmful. Extensive experiments demonstrate that this output-aware guardrail matches the safety performance of existing methods while drastically reducing over-refusal, thereby preserving the model's utility and built-in safety capabilities.